Physitrack for NHS Trusts: Remote Patient Engagement at Scale

• Physitrack runs live across 13 NHS organizations, from acute teaching hospitals and community MSK teams to children's services, occupational health, respiratory, community neuro, and primary care networks. It clears NHS-grade procurement bars in practice, not in theory.
• Guy's and St Thomas' (23,700 staff, £3.2bn turnover, four clinical groups) runs Physitrack across three separate departments, and Newcastle, Oxford, Royal Free London, Mersey Care, BHRUT, and Oxleas add breadth across care settings.
• This page covers clinical governance, information governance, Epic interoperability, multi-site deployment, and outcome reporting.
• Bupa, Nuffield Health, and Circle Health Group run on the same platform, so Physitrack is NHS-proven, not NHS-only.

Already deployed at two major NHS Foundation Trusts

Thirteen NHS organizations run Physitrack across a range of care settings, which tells you more than any feature list about whether the platform clears Trust-scale scrutiny. These are not single-clinic pilots. The deployments span acute teaching hospitals, community and MSK therapy teams, children's services, occupational health, respiratory and community neuro, learning disabilities, paediatric rheumatology, genetics, and primary care networks.

Guy's and St Thomas' NHS Foundation Trust is the flagship large-Trust proof point. It employs 23,700 staff, turns over £3.2 billion a year, and organizes its work into four clinical groups, each carrying "the staff (and budget) of a major hospital trust" (Guy's and St Thomas'). A platform that survives procurement at an organization of that size has cleared serious information governance and clinical safety review. Guy's and St Thomas' runs Physitrack across three separate departments, the main account, Paediatric Rheumatology and Chronic Pain, and Royal Brompton and Harefield, which shows the platform spreading beyond one team once it is inside the Trust.

The breadth across the other organizations matters as much as the size of any one. Newcastle upon Tyne Hospitals, Oxford University Hospitals, and Royal Free London represent large acute teaching Trusts. Mersey Care, Mersey and West Lancashire Teaching Hospitals, Barking, Havering and Redbridge University Hospitals, and Oxleas extend the footprint into community, mental health, and mixed acute and community provision. North Arden PCN and Liverpool John Moores University PCN show Physitrack working at the primary care network level, well outside the acute hospital.

Read together, these deployments answer the question a procurement or clinical governance lead actually asks first. Physitrack has passed through the same DSPT, clinical safety, and information governance gates that any Trust would apply, and it has done so repeatedly, across organizations of different sizes and clinical mixes. The sections that follow set out the certifications, interoperability standards, and reporting that support those deployments, but the adoption evidence is the starting point. Trusts already using Physitrack have made the procurement case themselves.

What NHS Trust procurement actually screens for

Before a Trust signs anything, it runs a platform through four gates. The first is DTAC, NHS England's baseline questionnaire covering clinical safety, data protection, cyber security, interoperability, and accessibility. The second is the pair of clinical risk management standards, DCB0129 and DCB0160, which sit in law under the Health and Social Care Act 2012. A vendor must hold a DCB0129 safety case, and the deploying Trust must complete its own DCB0160 assessment.

Those standards separate real platforms from the rest. A national study of 14,747 NHS digital deployments found only 17.3% were fully assured against both DCB standards, and 70.1% had no documented assurance at all. For provider trusts, median compliance sat at 24.5%.

The third gate is data assurance through the DSPT, which non-NHS suppliers meet through ISO 27001 or Cyber Essentials Plus. The fourth is a compliant route to market, typically Pillar 3 or an NHS SBS framework, sourced through the NHS Shared Business Services framework catalogue. The rest of this page answers each gate in turn.

Clinical governance and regulatory credentials

Physitrack holds ISO 27001 and ISO 13485 certification, the two credentials NHS clinical-governance teams can verify directly and weigh against their own assurance frameworks. ISO 27001 covers information security management, and NHS England accepts it as an equivalent route to Data Security and Protection Toolkit assurance for non-NHS suppliers, alongside Cyber Essentials Plus. ISO 13485 governs quality management for medical device manufacturers, so it speaks directly to how a clinical software product is designed, controlled, and maintained.

ISO 13485 carries weight beyond a single regulator. As of February 2, 2026, the FDA's Quality Management System Regulation incorporates ISO 13485:2016 by reference as the standard for medical device quality management systems. The same certification NHS Trusts see on a supplier's evidence pack is now embedded in the US quality framework, so it is a standard recognized across regulatory regimes rather than a voluntary badge.

Physitrack is also registered as a medical device with the FDA, and this registration adds device-level regulatory scrutiny on top of the quality system certification. Registration reflects the FDA's manufacturer requirements, including establishment registration, device listing, and quality management obligations.

For the UK specifically, the manufacturer-side clinical risk work sits with DCB0129, the standard requiring a Clinical Risk Management Plan, Hazard Log, and Clinical Safety Case Report signed off by a named Clinical Safety Officer. Documented manufacturer-side assurance is a genuine differentiator rather than a baseline most tools clear.

Information governance and data security

Physitrack answers the data-residency question directly. The platform is GDPR compliant and hosts data within the EU, which resolves the offshoring concern that stalls procurement when a supplier processes NHS data outside the UK or EEA. Where patient data leaves the UK, NHS England's own guidance requires evidence of compliance with UK GDPR Chapter V and the Offshoring and Public Cloud Policy, and EU hosting keeps that assessment straightforward for your information governance team.

Your Trust maintains DSPT compliance annually, and non-NHS suppliers demonstrate equivalent assurance through ISO 27001 or Cyber Essentials Plus certification rather than completing the DSPT itself. Physitrack holds ISO 27001, which is one of the two routes NHS England accepts as DSPT equivalence. That recognized route means your governance reviewers assess a known certification instead of a bespoke security questionnaire built for one supplier.

Physitrack fits an existing governance model rather than introducing a novel one. NHS England's virtual ward guidance expects a Data Protection Impact Assessment produced with your data protection officer, and a Data Sharing Agreement that names the NHS organisation as the data controller. Physitrack supports both. Your DPIA covers the specific deployment context, and the Data Sharing Agreement sets the controller and processor roles. The platform slots into the same information governance process you already run for other technology-enabled services.

Interoperability with Epic and existing Trust systems

Interoperability starts with the standard, not the vendor. NHS England is clear on this point, stating that "it is the standard that the API conforms to that is important, not the API itself" (NHS England). Physitrack builds toward the standards Trusts require, chiefly HL7 FHIR and FHIR UK Core, the framework NHS England names for standardizing API integration. Conformance to those standards, rather than a single proprietary connection, is what lets a patient engagement platform sit alongside a Trust's existing systems.

Epic matters here despite a small national footprint. An independent count of electronic patient record suppliers across the 214 NHS Trusts in England put Epic sixth by Trust count, at 13 Trusts, behind Oracle Cerner, Rio, and SystmOne (Paul Brown, LinkedIn). That ranking understates its relevance. Epic runs at some of the largest teaching-hospital Trusts, including Cambridge University Hospitals, University College London Hospitals, Great Ormond Street, and Guy's and St Thomas', which confirmed a £175M contract to deploy Epic (ignitedata.com). For a large acute Trust evaluating remote patient engagement, Epic is often the system a home exercise platform needs to work beside.

Epic is our flagship integration point for Trusts of this profile, and Guy's and St Thomas' is exactly the kind of Epic Trust where our fit is relevant. Beyond a single vendor relationship, the practical test for procurement is whether a platform conforms to the standards NHS England mandates and can meet the clinical risk management and secure authentication requirements that govern any system linking to Trust data. Physitrack is built to work within that framework rather than around it.

Multi-site, multi-discipline deployment across a Trust

Trusts almost never buy a single platform in one sitewide decision, and Physitrack's NHS footprint reflects that. Guy's and St Thomas', with 23,700 staff, a £3.2 billion turnover, and four clinical groups spanning therapies and rehabilitation, runs Physitrack across three separate departments. Its main account, its Paediatric Rheumatology and Chronic Pain service, and its Royal Brompton and Harefield sites each operate on the platform, which shows a single Trust can extend the same tool across distinct clinical groups.

Royal Free London demonstrates the same pattern at department level, running three separate accounts. Two cover Adult Community Therapies and a third serves its Private Patients Unit. Mersey and West Lancashire Teaching Hospitals mirrors this with three accounts across Ormskirk Orthopaedics, S&O Children's Services, and S&O Acute and Critical Care. Each service onboards on its own timeline, so a physiotherapy team can adopt Physitrack without waiting for occupational therapy, paediatrics, or critical care to sign off first.

The breadth extends well beyond large teaching hospitals. Physitrack is deployed across 13 NHS organizations, including Newcastle upon Tyne Hospitals, Oxford University Hospitals, Mersey Care, BHRUT, and Oxleas, plus primary care networks at North Arden PCN and Liverpool John Moores University PCN. Those deployments span community and MSK therapy, respiratory, community neuro, learning disabilities, and paediatric rheumatology.

That range matters because a single-department tool leaves each service to solve prescription and adherence tracking separately, which fragments reporting across a Trust. Physitrack lets each department run on the same platform while keeping its own account.

Exercise library, adherence tracking, and outcome reporting

Clinicians prescribe from the 18,000+ exercise library, patients complete their programs through PhysiApp, and every interaction feeds adherence tracking that turns a home exercise program into a measurable record. That record is what a Trust reports against when it justifies a service to a commissioner or defends a pathway during audit, which is why the library matters beyond its size.

Adherence data and PROMs give you the numerator and denominator for outcome reporting. You can show how many patients started a program, how many stayed engaged, and how their reported function changed over a course of treatment. Those numbers answer the two questions commissioners repeat every cycle: did patients use the intervention, and did it change anything measurable?

The analytics also support the usability and outcomes expectations built into DTAC. DTAC's Usability and Accessibility section is the only scored part of the framework, and it looks for evidence of real-world use and outcomes rather than a claimed benefit (Assuric). Adherence and PROMs data give a deploying Trust exactly that evidence, drawn from its own patients rather than a vendor's marketing.

The library and the analytics work as one reporting mechanism. The library gives clinicians credible content to prescribe, and the tracking layer converts that clinical activity into the audit and commissioning evidence a Trust already has to generate. Physitrack builds both to serve NHS reporting cycles, not just day-to-day clinical convenience.

Beyond the NHS: one platform across UK care

The same platform that runs at Guy's and St Thomas' also runs across major UK private providers, including Bupa, Nuffield Health, and Circle Health Group. That range matters to a Trust buyer because it tells you Physitrack is not a bespoke NHS build maintained to a single specification. Physitrack is a product proven under the operational demands of both public and private care.

Cross-sector adoption strengthens the case. Private networks apply their own security, clinical, and commercial scrutiny before rolling out software at scale, and Physitrack clears both their requirements and NHS procurement standards. For a head of therapy or digital transformation lead, that breadth signals a platform with the development resources and stability to support a Trust-wide deployment for years, not a niche supplier dependent on a single sector.

Conclusion

Guy's and St Thomas' NHS Foundation Trust NHS Foundation Trust runs Physitrack for digital patient engagement across large, multi-site, multi-discipline operations. Live Trust deployments prove the platform clears the procurement scrutiny that most digital tools stall on. The ISO 27001 and ISO 13485 certifications, GDPR compliance with EU hosting, FHIR-based interoperability, and adherence analytics behind those deployments meet the standards your governance and information security teams already screen against.

If you are evaluating remote patient engagement at Trust scale, the governance and compliance pack is available for your assurance review, and the Trust partnerships team can arrange a deployment discussion across your therapy and allied health departments — contact them to request the pack or book a call.